Agent skill · mindrally
security-devsecops
DevSecOps, secure software development lifecycle (SSDLC), and application security (AppSec) practices covering secret handling, input validation, dependency hygiene, authentication/authorization, and CI/CD security tooling (SAST, SCA, DAST, secret scanning, IaC scanning). Use when writing code that handles credentials, user input, database queries, or authentication, when setting up a CI/CD pipeline, or when reviewing code or infrastructure for security issues.
What it needs
About 5k tokens when loaded.
What this skill does
Security / DevSecOps This skill covers secure coding practices, dependency and secret hygiene, authentication and authorization, and the security tooling that belongs in a secure software development lifecycle (SSDLC) — from local coding habits through CI/CD gates to production monitoring. Workflow for Adding a New Feature Securely 1. Identify trust boundaries — Note every place the new code accepts input from a user, another service, or a file, and every place it emits output (HTML, logs, another service). 2. Validate and sanitize at the boundary — Validate all untrusted input on entry; escape output for its destination context (HTML, JS, SQL, shell). 3. Use existing security primitives — Reach for the project's established auth framework, ORM, and secret-management approach rather than writing new ones. 4. Keep secrets out of code and logs — Read credentials from environment variables or a secrets vault; confirm nothing sensitive reaches logs or error messages. 5. Run local security checks before pushing — Lint, SAST, and secret-scanning tools where available (gitleaks, semgrep, npm audit, pip-audit, etc.). 6. Let CI gates run — SAST, SCA, secret scanning, and IaC scanning should run on every PR; treat a failure as a blocker, not a suggestion to suppress. 7. Document the security-relevant decision — Note in the PR description any auth/authz change, new dependency, or deviation from a default-secure pattern, so it's auditable later. General Security Principles Never hardcode secrets, credentials, or API keys in source code. Use environment variables or a secure vault (e.g. AWS Secrets Manager, HashiCorp Vault, Doppler) for sensitive data. Never commit .env files, secret config files, or unrecognized tokens to source control. Add them to .gitignore before they're ever staged. Never log sensitive data, secrets, or session tokens in application logs — redact or omit them at the point of logging, not after the fact. …
How to use it
Reference it in AdaL, Claude Code, Cursor or any coding agent — nothing to install:
@skills mindrally/security-devsecops